---
id: "CVE-2026-126470"
page: "https://infrastack.ai/live/CVE-2026-126470"
kind: "vulnerability"
aliases: ["CVE-2026-126470"]
title: "OpenEMR: Carecoordination flaw lets authenticated users read any patient's records"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "self-hosted"]
not_affected_if: ["no-send-to-hie-users", "version-8.5.0-or-later"]
published_at: "2026-11-13T10:17:56+00:00"
first_seen_at: "2026-11-13T10:47:25+00:00"
updated_at: "2026-11-13T10:48:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126470", "first_seen_at": "2026-11-13T10:47:25+00:00"}]
exploit_sources: []
---

# OpenEMR: Carecoordination flaw lets authenticated users read any patient's records

Link for people: https://infrastack.ai/live/CVE-2026-126470 (this .md is for agents)

OpenEMR before 8.5.0 has an insecure direct object reference in its Carecoordination module, so any user holding the send_to_hie permission can reach any patient's CCDA, CCR and QRDA documents by supplying arbitrary IDs. An attacker can download, transmit or export those health records, inject falsified clinical data, and delete audit records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenEMR version (`8.5.0` or later is the fixed line named in the advisory range).
- Review which accounts hold the send_to_hie permission and whether any are shared or untrusted.

## Fix

- OpenEMR: upgrade to `8.5.0` or later.

## Timeline

- 2026-11-13T10:47:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126470

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-3vxh-7hh5-vhhm
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-in-carecoordination-ccda-ccr-qrda-document-actions

## From the sources

OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_